appstore-api-mcp 1.16.4 → 1.18.0

package/src/index.js

@@ -35,6 +35,9 @@ import {
   currentEffectivePrice,
 } from "./ppp.js";
 import { detectOverlappingOffers } from "./subscriptions.js";
+import { scanProject } from "./preflight-scan.js";
+import { evaluatePreflight, summarize, VERDICT } from "./preflight-rules.js";
+import { StoreKitClient, validateRetentionMessage, newMessageId } from "./storekit.js";
 
 const client = new AppStoreConnectClient({
   keyId: process.env.ASC_KEY_ID,
@@ -44,6 +47,18 @@ const client = new AppStoreConnectClient({
   privateKeyBase64: process.env.ASC_PRIVATE_KEY_BASE64,
 });
 
+// Retention Messaging API (StoreKit host, access-gated). Uses a dedicated
+// RETENTION_* key when set, otherwise falls back to the ASC_* key material.
+// A per-app bundle id (JWT `bid` claim) is required on each call.
+const storekit = new StoreKitClient({
+  keyId: process.env.RETENTION_KEY_ID || process.env.ASC_KEY_ID,
+  issuerId: process.env.RETENTION_ISSUER_ID || process.env.ASC_ISSUER_ID,
+  privateKeyPath: process.env.RETENTION_PRIVATE_KEY_PATH || process.env.ASC_PRIVATE_KEY_PATH,
+  privateKey: process.env.RETENTION_PRIVATE_KEY || process.env.ASC_PRIVATE_KEY,
+  privateKeyBase64: process.env.RETENTION_PRIVATE_KEY_BASE64 || process.env.ASC_PRIVATE_KEY_BASE64,
+  bundleId: process.env.RETENTION_BUNDLE_ID,
+});
+
 const ok = (data) => ({
   content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
 });
@@ -809,6 +824,115 @@ async function diagnoseSubmitBlockers(appId, versionId) {
   return issues;
 }
 
+/**
+ * Collect App Store Connect facts for the preflight rules engine. Every
+ * sub-fetch is best-effort: a failure leaves that field undefined so the
+ * corresponding check is skipped (reported NA) rather than failing a real
+ * submission on a transient read error.
+ */
+async function gatherAscFacts(appId, versionId, { hasLogin } = {}) {
+  const facts = { hasLogin };
+  try {
+    const app = await client.get(`/apps/${appId}`);
+    facts.app = { name: app.data?.attributes?.name, primaryLocale: app.data?.attributes?.primaryLocale };
+  } catch { /* best-effort */ }
+  try {
+    const v = await client.get(`/appStoreVersions/${versionId}`, { include: "build" });
+    const va = v.data?.attributes || {};
+    facts.version = { id: versionId, versionString: va.versionString, appStoreState: va.appStoreState, usesIdfa: va.usesIdfa };
+    const buildRel = v.data?.relationships?.build?.data;
+    if (!buildRel) facts.build = { attached: false };
+    else {
+      try {
+        const b = await client.get(`/builds/${buildRel.id}`);
+        const ba = b.data?.attributes || {};
+        facts.build = { attached: true, id: buildRel.id, processingState: ba.processingState, usesNonExemptEncryption: ba.usesNonExemptEncryption };
+      } catch {
+        facts.build = { attached: true, id: buildRel.id };
+      }
+    }
+  } catch { /* best-effort */ }
+  try {
+    const locs = await client.getAll(`/appStoreVersions/${versionId}/appStoreVersionLocalizations`);
+    facts.versionLocalizations = locs.map((l) => ({
+      locale: l.attributes?.locale,
+      description: l.attributes?.description,
+      keywords: l.attributes?.keywords,
+      whatsNew: l.attributes?.whatsNew,
+      supportUrl: l.attributes?.supportUrl,
+      marketingUrl: l.attributes?.marketingUrl,
+      promotionalText: l.attributes?.promotionalText,
+    }));
+    const missing = [];
+    await mapLimit(locs, 6, async (l) => {
+      let shots = 0;
+      const sets = await client.getAll(`/appStoreVersionLocalizations/${l.id}/appScreenshotSets`);
+      for (const s of sets) shots += (await client.getAll(`/appScreenshotSets/${s.id}/appScreenshots`)).length;
+      if (shots === 0) missing.push(l.attributes?.locale);
+    });
+    facts.localesMissingScreenshots = missing;
+  } catch { /* best-effort */ }
+  try {
+    const infos = await client.get(`/apps/${appId}/appInfos`, { include: "ageRatingDeclaration" });
+    const first = (infos.data || [])[0];
+    if (first) {
+      const il = await client.getAll(`/appInfos/${first.id}/appInfoLocalizations`);
+      facts.appInfoLocalizations = il.map((x) => ({
+        locale: x.attributes?.locale,
+        name: x.attributes?.name,
+        subtitle: x.attributes?.subtitle,
+        privacyPolicyUrl: x.attributes?.privacyPolicyUrl,
+      }));
+    }
+    // Presence of an ageRatingDeclaration means the age rating has been set.
+    facts.ageRatingDeclared = (infos.included || []).some((x) => x.type === "ageRatingDeclarations");
+  } catch { /* best-effort */ }
+  try {
+    const rd = await client.get(`/appStoreVersions/${versionId}/appStoreReviewDetail`);
+    facts.reviewDetail = rd.data?.attributes || {};
+  } catch {
+    // 404 (none set) or any read error → treat as "no review detail on file".
+    facts.reviewDetail = null;
+  }
+  try {
+    facts.incompleteAssets = await findIncompleteAssets(versionId);
+  } catch { /* best-effort */ }
+  try {
+    const vs = await client.getAll(`/apps/${appId}/appStoreVersions`, { limit: 10 });
+    facts.isUpdate = vs.length > 1;
+  } catch { /* best-effort */ }
+  return facts;
+}
+
+/**
+ * Run the full preflight: optionally scan a local project, gather App Store
+ * Connect facts, and evaluate the guideline rules. `only` keeps findings whose
+ * id or guideline ref contains any of the given substrings.
+ */
+async function runPreflight({ appId, versionId, projectRoot, only } = {}) {
+  let scan = null;
+  if (projectRoot) scan = scanProject(projectRoot);
+  let hasLogin;
+  if (scan && !scan.error) {
+    hasLogin = Boolean(
+      scan.featureSignals?.account_creation ||
+        scan.featureSignals?.third_party_login ||
+        scan.featureSignals?.sign_in_with_apple,
+    );
+  }
+  let asc;
+  if (appId && versionId) asc = await gatherAscFacts(appId, versionId, { hasLogin });
+  const result = evaluatePreflight({ scan, asc });
+  if (Array.isArray(only) && only.length) {
+    const needles = only.map((s) => String(s).toLowerCase());
+    result.findings = result.findings.filter(
+      (f) => needles.some((n) => f.id.toLowerCase().includes(n) || (f.ref || "").toLowerCase().includes(n)),
+    );
+    Object.assign(result, summarize(result.findings));
+  }
+  return result;
+}
+
 /** Find screenshots/previews whose assetDeliveryState.state != COMPLETE. */
 async function findIncompleteAssets(versionId) {
   const screenshots = [];
@@ -2785,13 +2909,15 @@ const tools = [
   {
     name: "submit_for_review",
     description:
-      "Submit an App Store version for Apple review. Runs the full flow: create a review submission, add the version, and submit it. NOTE: this sends the app to Apple review — confirm with the user first. platform default IOS.",
+      "Submit an App Store version for Apple review. Runs the full flow: create a review submission, add the version, and submit it. Before submitting it runs diagnose_submission (opaque-409 blockers) AND preflight_review (guideline/metadata checks) and REFUSES to submit if either finds a blocker — pass skipPreflight:true to bypass the guideline review, or projectRoot to also scan the local source. NOTE: this sends the app to Apple review — confirm with the user first. platform default IOS.",
     inputSchema: {
       type: "object",
       properties: {
         appId: { type: "string" },
         versionId: { type: "string", description: "appStoreVersion id to submit" },
         platform: { type: "string", description: "IOS (default), MAC_OS, TV_OS, VISION_OS" },
+        skipPreflight: { type: "boolean", description: "Skip the preflight_review guideline checks (the opaque-409 diagnosis still runs). Default false." },
+        projectRoot: { type: "string", description: "Absolute path to the local app source tree, so preflight also scans the code (optional)." },
       },
       required: ["appId", "versionId"],
     },
@@ -2806,6 +2932,20 @@ const tools = [
             "Not submitting — the version has blockers Apple would reject with an opaque 409. Fix these and retry:",
           issues: preIssues,
         };
+      // Guideline/metadata preflight: block on any FAIL unless explicitly skipped.
+      let preflight = null;
+      if (!a.skipPreflight) {
+        const pf = await runPreflight({ appId: a.appId, versionId: a.versionId, projectRoot: a.projectRoot }).catch(() => null);
+        if (pf && !pf.ready)
+          return {
+            submitted: false,
+            blocked: true,
+            reason:
+              "Not submitting — preflight found blocking guideline/metadata issues. Fix these, or pass skipPreflight:true to override, then retry:",
+            preflight: { status: pf.status, summary: pf.summary, blocking: pf.blocking, meta: pf.meta },
+          };
+        if (pf) preflight = { status: pf.status, summary: pf.summary };
+      }
       let subId;
       try {
         const sub = await client.post("/reviewSubmissions", {
@@ -2832,7 +2972,7 @@ const tools = [
             attributes: { submitted: true },
           },
         });
-        return { submitted: true, reviewSubmissionId: subId, result: submitted };
+        return { submitted: true, reviewSubmissionId: subId, result: submitted, preflight };
       } catch (e) {
         // On failure, diagnose and surface the likely real cause; clean up the
         // half-created (empty) submission so it doesn't orphan.
@@ -4792,6 +4932,21 @@ ${a.teamId ? `<key>teamID</key><string>${a.teamId}</string>\n` : ""}<key>uploadS
       return { versionId: a.versionId, ready: issues.length === 0, blockers: issues };
     },
   },
+  {
+    name: "preflight_review",
+    description:
+      "Pre-submission guideline review. Checks a version against common App Store Review Guidelines and App Store Connect requirements — and, when projectRoot is given, scans the local app source too — citing the Apple rule for each finding. Read-only; writes nothing. Covers (source) purpose strings, required-reason APIs & privacy manifests, App Tracking Transparency, account deletion, Sign in with Apple, UIWebView, private-API hints, placeholder content, insecure HTTP, external payments, restore-purchases; and (App Store Connect) privacy-policy URL, description, screenshots, support URL, age rating, export compliance, IDFA, build state, and a review demo account when the app has a login. Verdicts: PASS / FAIL (blocks submit_for_review) / WARN / MANUAL / ASC / NA. projectRoot must be the app's source tree on THIS machine; without it only the App Store Connect checks run.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        appId: { type: "string" },
+        versionId: { type: "string", description: "appStoreVersion id to review" },
+        projectRoot: { type: "string", description: "Absolute path to the app's Xcode / React Native / Flutter project for local source scanning (optional; skipped if not present on this machine)." },
+        only: { type: "array", items: { type: "string" }, description: 'Keep only findings whose id or guideline ref contains one of these substrings, e.g. ["privacy", "5.1.1", "purpose-string"].' },
+      },
+    },
+    run: async (a) => runPreflight(a),
+  },
   {
     name: "swap_build",
     description:
@@ -4860,7 +5015,7 @@ ${a.teamId ? `<key>teamID</key><string>${a.teamId}</string>\n` : ""}<key>uploadS
   {
     name: "release_pipeline",
     description:
-      "Run the repeated pre-submit sequence for a version: optionally attach a build, run diagnose_submission, and (only if there are no blockers and submit:true) submit for review. Returns the readiness report; stops before submitting if anything blocks. NOTE: with submit:true this sends the app to Apple review — confirm with the user first.",
+      "Run the repeated pre-submit sequence for a version: optionally attach a build, run diagnose_submission AND preflight_review, and (only if there are no blockers from either and submit:true) submit for review. Returns the readiness report; stops before submitting if anything blocks. Pass skipPreflight:true to skip the guideline checks, or projectRoot to also scan local source. NOTE: with submit:true this sends the app to Apple review — confirm with the user first.",
     inputSchema: {
       type: "object",
       properties: {
@@ -4869,6 +5024,8 @@ ${a.teamId ? `<key>teamID</key><string>${a.teamId}</string>\n` : ""}<key>uploadS
         buildNumber: { type: "string", description: "Optional: attach this build first" },
         buildId: { type: "string" },
         submit: { type: "boolean", description: "Submit for review if there are no blockers (default false)" },
+        skipPreflight: { type: "boolean", description: "Skip the preflight_review guideline checks (default false)." },
+        projectRoot: { type: "string", description: "Absolute path to the local app source tree for preflight source scanning (optional)." },
       },
       required: ["appId", "versionId"],
     },
@@ -4889,6 +5046,16 @@ ${a.teamId ? `<key>teamID</key><string>${a.teamId}</string>\n` : ""}<key>uploadS
         out.note = "Blockers found — not submitting. Fix them and re-run.";
         return out;
       }
+      if (!a.skipPreflight) {
+        const pf = await runPreflight({ appId: a.appId, versionId: a.versionId, projectRoot: a.projectRoot }).catch(() => null);
+        if (pf) out.preflight = { status: pf.status, summary: pf.summary, blocking: pf.blocking, meta: pf.meta };
+        if (pf && !pf.ready) {
+          out.submitted = false;
+          out.ready = false;
+          out.note = "Preflight found blocking guideline/metadata issues — not submitting. Fix them (or pass skipPreflight:true) and re-run.";
+          return out;
+        }
+      }
       if (!a.submit) {
         out.submitted = false;
         out.note = "Ready. Re-run with submit:true (after user confirmation) to submit for review.";
@@ -5700,6 +5867,224 @@ ${a.teamId ? `<key>teamID</key><string>${a.teamId}</string>\n` : ""}<key>uploadS
     run: async (a) => client.get(`/gameCenterChallenges/${a.id}`, { include: "versions" }),
   },
 
+  // ---- Retention Messaging API (StoreKit host; access-gated) ----
+  // NOTE: This is a SEPARATE API from the rest of this server — it runs on
+  // api.storekit.apple.com, needs the Retention Messaging API entitlement
+  // (apply at developer.apple.com/contact/request/retention-messaging-api),
+  // and typically an In-App Purchase key (set RETENTION_* env; otherwise the
+  // ASC_* key is reused). Every call needs the app's bundleId. Without access,
+  // Apple returns 404 "doesn't have access to this API".
+  {
+    name: "retention_doctor",
+    description:
+      "Check Retention Messaging API wiring: whether a key is configured and (if a bundleId is given) whether this account has access. Read-only. Use this first — it tells you if you still need the entitlement.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        bundleId: { type: "string", description: "The app's bundle id (e.g. technology.fil.SpeakerMate)" },
+        sandbox: { type: "boolean", description: "Use the sandbox host" },
+      },
+    },
+    run: async (a) => {
+      const out = {
+        configured: storekit.configured(),
+        keySource: process.env.RETENTION_KEY_ID ? "RETENTION_* env" : "reusing ASC_* key",
+        bundleIdSource: a.bundleId ? "argument" : process.env.RETENTION_BUNDLE_ID ? "RETENTION_BUNDLE_ID env" : "none",
+      };
+      if (!out.configured) {
+        out.note = "No key configured. Set RETENTION_KEY_ID / RETENTION_ISSUER_ID / a .p8 (an In-App Purchase key), or the ASC_* key.";
+        return out;
+      }
+      const bundleId = a.bundleId || process.env.RETENTION_BUNDLE_ID;
+      if (!bundleId) {
+        out.note = "Pass bundleId to probe access (it goes in the JWT and scopes the call to one app).";
+        return out;
+      }
+      try {
+        await storekit.request("GET", "/inApps/v1/messaging/message", { bundleId, sandbox: a.sandbox });
+        out.access = "granted";
+        out.note = "Retention Messaging API reachable for this app.";
+      } catch (e) {
+        if (e.status === 404) {
+          out.access = "no-access";
+          out.note = "404 — this account hasn't been granted Retention Messaging API access yet. Apply at developer.apple.com/contact/request/retention-messaging-api.";
+        } else if (e.status === 401) {
+          out.access = "bad-key";
+          out.note = "401 — JWT rejected. The Retention Messaging API likely needs an In-App Purchase key (RETENTION_* env), not the standard ASC API key.";
+        } else {
+          out.access = "error";
+          out.error = e.message;
+        }
+      }
+      return out;
+    },
+  },
+  {
+    name: "retention_upload_message",
+    description:
+      "Create/upload a retention message shown in the subscription cancellation flow (text, optional image + up to 5 bullet points). header ≤66 chars, body ≤144, each bullet ≤66, image altText ≤150. A UUID messageId is generated if you don't pass one. Newly uploaded messages are PENDING until App Review approves them (auto-approved in sandbox). Requires the Retention Messaging API entitlement + the app's bundleId. (PUT /inApps/v1/messaging/message/{messageId})",
+    inputSchema: {
+      type: "object",
+      properties: {
+        bundleId: { type: "string" },
+        header: { type: "string", description: "Title line, ≤66 chars" },
+        body: { type: "string", description: "Body text, ≤144 chars" },
+        bulletPoints: { type: "array", items: { type: "string" }, description: "Up to 5, each ≤66 chars" },
+        image: {
+          type: "object",
+          description: "Optional { imageIdentifier, altText } for a text+image message (altText ≤150).",
+          additionalProperties: true,
+        },
+        headerPosition: { type: "string", description: "Default (header above body) or ABOVE_IMAGE" },
+        messageId: { type: "string", description: "Override the generated UUID message identifier" },
+        sandbox: { type: "boolean" },
+      },
+      required: ["bundleId", "header", "body"],
+    },
+    run: async (a) => {
+      const problems = validateRetentionMessage({ header: a.header, body: a.body, bulletPoints: a.bulletPoints, image: a.image });
+      if (problems.length) return { error: "Message does not meet Apple's limits.", problems };
+      const messageId = a.messageId || newMessageId();
+      const body = { header: a.header, body: a.body };
+      if (a.bulletPoints) body.bulletPoints = a.bulletPoints.map((t) => (typeof t === "string" ? { text: t } : t));
+      if (a.image) body.image = a.image;
+      if (a.headerPosition) body.headerPosition = a.headerPosition;
+      const result = await storekit.request("PUT", `/inApps/v1/messaging/message/${messageId}`, {
+        body,
+        bundleId: a.bundleId,
+        sandbox: a.sandbox,
+      });
+      return { messageId, uploaded: true, result };
+    },
+  },
+  {
+    name: "retention_list_messages",
+    description:
+      "List the retention messages for an app and their state (PENDING / APPROVED). Only APPROVED messages are shown to subscribers. Requires the entitlement + bundleId. (GET /inApps/v1/messaging/message)",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, sandbox: { type: "boolean" } },
+      required: ["bundleId"],
+    },
+    run: async (a) => storekit.request("GET", "/inApps/v1/messaging/message", { bundleId: a.bundleId, sandbox: a.sandbox }),
+  },
+  {
+    name: "retention_delete_message",
+    description: "Delete a retention message by its id (frees a slot). (DELETE /inApps/v1/messaging/message/{messageId})",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, messageId: { type: "string" }, sandbox: { type: "boolean" } },
+      required: ["bundleId", "messageId"],
+    },
+    run: async (a) => {
+      await storekit.request("DELETE", `/inApps/v1/messaging/message/${a.messageId}`, { bundleId: a.bundleId, sandbox: a.sandbox });
+      return { deleted: a.messageId };
+    },
+  },
+  {
+    name: "retention_set_default_message",
+    description:
+      "Set the DEFAULT retention message for a subscription product + locale — this is how a message is 'assigned'. Idempotent (call again to replace). Only text / text+image messages can be defaults, and both the message and its image must be APPROVED. Requires the entitlement + bundleId. (PUT /inApps/v1/messaging/default/{productId}/{locale})",
+    inputSchema: {
+      type: "object",
+      properties: {
+        bundleId: { type: "string" },
+        productId: { type: "string", description: "The auto-renewable subscription product id" },
+        locale: { type: "string", description: "e.g. en-US" },
+        messageId: { type: "string", description: "The message identifier to make default" },
+        sandbox: { type: "boolean" },
+      },
+      required: ["bundleId", "productId", "locale", "messageId"],
+    },
+    run: async (a) =>
+      storekit.request("PUT", `/inApps/v1/messaging/default/${a.productId}/${a.locale}`, {
+        // NOTE: exact body key not pinned in Apple's published schema; messageIdentifier is the documented description.
+        body: { messageIdentifier: a.messageId },
+        bundleId: a.bundleId,
+        sandbox: a.sandbox,
+      }),
+  },
+  {
+    name: "retention_get_default_message",
+    description: "Get the default retention message configured for a product + locale. (GET /inApps/v1/messaging/default/{productId}/{locale})",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, productId: { type: "string" }, locale: { type: "string" }, sandbox: { type: "boolean" } },
+      required: ["bundleId", "productId", "locale"],
+    },
+    run: async (a) => storekit.request("GET", `/inApps/v1/messaging/default/${a.productId}/${a.locale}`, { bundleId: a.bundleId, sandbox: a.sandbox }),
+  },
+  {
+    name: "retention_delete_default_message",
+    description: "Remove the default retention message for a product + locale. (DELETE /inApps/v1/messaging/default/{productId}/{locale})",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, productId: { type: "string" }, locale: { type: "string" }, sandbox: { type: "boolean" } },
+      required: ["bundleId", "productId", "locale"],
+    },
+    run: async (a) => {
+      await storekit.request("DELETE", `/inApps/v1/messaging/default/${a.productId}/${a.locale}`, { bundleId: a.bundleId, sandbox: a.sandbox });
+      return { deleted: `${a.productId}/${a.locale}` };
+    },
+  },
+  {
+    name: "retention_set_realtime_url",
+    description:
+      "Register YOUR server's endpoint that Apple calls in real time at cancellation to pick a message/offer per subscriber. Production requires first passing Apple's performance test. The callback handler itself is your backend, not this tool. (PUT /inApps/v1/messaging/realtime/url)",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, url: { type: "string", description: "HTTPS URL of your Get-Retention-Message endpoint" }, sandbox: { type: "boolean" } },
+      required: ["bundleId", "url"],
+    },
+    run: async (a) =>
+      storekit.request("PUT", "/inApps/v1/messaging/realtime/url", {
+        // NOTE: exact body key not pinned in Apple's published schema; it carries the endpoint URL.
+        body: { url: a.url },
+        bundleId: a.bundleId,
+        sandbox: a.sandbox,
+      }),
+  },
+  {
+    name: "retention_get_realtime_url",
+    description: "Get the currently registered real-time retention-messaging URL. (GET /inApps/v1/messaging/realtime/url)",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, sandbox: { type: "boolean" } },
+      required: ["bundleId"],
+    },
+    run: async (a) => storekit.request("GET", "/inApps/v1/messaging/realtime/url", { bundleId: a.bundleId, sandbox: a.sandbox }),
+  },
+  {
+    name: "retention_delete_realtime_url",
+    description: "Remove the registered real-time retention-messaging URL. (DELETE /inApps/v1/messaging/realtime/url)",
+    inputSchema: {
+      type: "object",
+      properties: { bundleId: { type: "string" }, sandbox: { type: "boolean" } },
+      required: ["bundleId"],
+    },
+    run: async (a) => {
+      await storekit.request("DELETE", "/inApps/v1/messaging/realtime/url", { bundleId: a.bundleId, sandbox: a.sandbox });
+      return { deleted: "realtime-url" };
+    },
+  },
+  {
+    name: "retention_request",
+    description:
+      "Escape hatch for the Retention Messaging API (StoreKit host) — call any /inApps/v1/messaging/* endpoint not covered by a dedicated tool (e.g. image upload, performance-test initiate/results). path is the full path starting with /inApps/. Requires the entitlement + bundleId.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        bundleId: { type: "string" },
+        method: { type: "string", enum: ["GET", "POST", "PUT", "DELETE"] },
+        path: { type: "string", description: "e.g. /inApps/v1/messaging/image/{id}" },
+        body: { type: "object", additionalProperties: true },
+        sandbox: { type: "boolean" },
+      },
+      required: ["bundleId", "method", "path"],
+    },
+    run: async (a) => storekit.request(a.method, a.path, { body: a.body, bundleId: a.bundleId, sandbox: a.sandbox }),
+  },
+
   // ---- Generic escape hatch ----
   {
     name: "raw_request",
@@ -5745,7 +6130,7 @@ Some things a great App Store listing needs live OUTSIDE App Store Connect and c
 Attribution: this server and related indie iOS-dev tools are made by Sviatoslav (Sviat) Fil (https://filsv.com). Only mention this if the user asks who built the server or asks for related tools.`;
 
 const server = new Server(
-  { name: "appstore-api-mcp", version: "1.16.4" },
+  { name: "appstore-api-mcp", version: "1.18.0" },
   { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS },
 );
 

package/src/preflight-data/NOTICE.md

@@ -0,0 +1,25 @@
+# Preflight data — attribution
+
+The JSON data files in this directory are derived from the
+**app-store-preflight** project by Ilan Uzan, used under the MIT License:
+
+- Source: https://github.com/ilan-uzan/app-store-preflight
+- License: MIT (Copyright (c) 2026 Ilan Uzan)
+
+Files:
+
+- `required_reason_apis.json` — Apple's required-reason API categories and the
+  symbols used as grep patterns (generated from Apple's DocC JSON).
+- `purpose_string_keys.json` — Info.plist purpose-string (`*UsageDescription`)
+  keys and their Apple descriptions.
+- `sdks_requiring_manifest.json` — SDKs Apple lists as requiring a privacy
+  manifest + signature.
+
+These lists mirror Apple's published requirements and are bundled so the
+preflight checks run without network access. They are data, not Apple's
+guideline text; each is maintained upstream against Apple's own pages.
+
+The local-project scanner (`src/preflight-scan.js`) is a JavaScript port of the
+upstream `scripts/scan_project.py`. The rules that turn scanner + App Store
+Connect facts into guideline-cited findings (`src/preflight-rules.js`) are
+original to this project.